AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Assign two separate policies manually to each subscription and skip remediation.

  Why it's wrong here

  Assigning two separate policies manually to each subscription sacrifices centralized governance and creates inconsistent configuration as the subscription portfolio grows. If a new subscription is added later, an administrator must remember to repeat the assignment, potentially leaving that subscription completely ungoverned. Skipping remediation also leaves pre-existing resources that already lack the required tag unflagged and noncompliant, so the policy only restricts future deployments while doing nothing to correct current drift.

  When this WOULD be correct

  This option would be correct if the question required applying two unrelated policies to individual subscriptions without needing a unified compliance view or automatic remediation, and manual per-subscription assignment was acceptable.

• ✓

  Assign an initiative at the management group scope that contains the tag and allowed-location policies, then remediate the tag policy.

  Why this is correct

  An initiative groups multiple policies into one assignment, which gives the team a single compliance view and consistent enforcement across all current and future subscriptions under the management group. The tag policy can then be remediated for existing resources where the effect supports it, while the location rule blocks future noncompliant deployments.

• ✗

  Assign Contributor to the management group so administrators can fix any noncompliant resource manually.

  Why it's wrong here

  Granting Contributor at the management group scope grants broad write and delete permissions across every subscription, yet it imposes no logic that forces resource locations or tag values. The role only lets a human fix noncompliant resources after deployment, so enforcement is inconsistent, manual, and prone to error. This approach also unnecessarily expands the access surface for all assigned users, violating least privilege and creating a governance risk rather than solving the policy need.

  When this WOULD be correct

  This option would be correct if the question asked for a way to allow administrators to manually fix noncompliant resources without automated enforcement, such as in a scenario where governance is advisory and requires human intervention.

• ✗

  Apply a CanNotDelete lock at the management group scope to prevent drift.

  Why it's wrong here

  CanNotDelete is an Azure Resource Manager lock that only prevents deletion of a resource; it does not block creation in disallowed regions, and it cannot add a missing tag, so it fails to enforce either governance rule. Resource locks are scoped to subscriptions, resource groups, or individual resources—not management groups—so this action would not even apply at the requested level. A lock also blocks legitimate delete operations long after the compliance issue was missed, creating an operational burden without adding any actual compliance enforcement.

  When this WOULD be correct

  A question asks for a method to prevent accidental deletion of critical resources across a management group, with no requirement for governance rules or compliance monitoring.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question